Java Spring Framework Exception Alerts for Access Denied and CSRF Failures

Alerts on Spring Security exception keywords related to access denial, CSRF, cookies, and request rejection in application logs.

FreeReviewedSigma · Medium · v5

Product: spring
Category: application
Author: Thomas Patzke (SigmaHQ), DRL 1.1
Published: 2017-08-06
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Initial Access

Recon
Resource Dev
Initial Access
- T1190Exploit Public-Facing Application
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags application log entries containing specific Spring Framework security-related exceptions, including access denial and CSRF token validation failures. These errors can appear when an attacker probes protected endpoints or attempts to bypass request protections such as CSRF enforcement. The detection relies on keyword matches within application logs from Spring-based applications that record these exception types.

Reporting behind it

Related detections9 linkedT1190 — drag to rearrange

Suspicious Executable Run from IIS aspnet_client or Windows Tasks Directory via process_creation

Suspicious Telerik UI RadAsyncUpload Request Indicating CVE-2019-18935 Exploitation (via webserver)

Malicious IIS Worker Process Spawning Shell for Out-of-Band Interaction via Command Line

Malicious wp2shell WordPress Exploitation via Batch Endpoint User Agent

Suspicious TOLLBOOTH Webshell URI Access

Suspicious ffuf Fuzzing Requests Against Web Server

Suspicious AI Agent Compromise via Web Worker Spawning Shell or Network Tool

Malicious wp2shell WordPress RCE via Web Server Spawning Shell Recon

Suspicious Child Process Spawned by IIS Worker Process w3wp

Java Spring Framework Exception Alerts for Access Denied and CSRF Failures

Pivot detection · T1190 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

spring-framework-security-exceptions-indicating-suspicious-access-and-csrf-handl-ae48ab93

title: Java Spring Framework Exception Alerts for Access Denied and CSRF Failures
id: db1b31bd-e40c-4239-b45a-2688b73f5db1
status: stable
description: This rule flags application log entries containing specific Spring Framework security-related exceptions, including access denial and CSRF token validation failures. These errors can appear when an attacker probes protected endpoints or attempts to bypass request protections such as CSRF enforcement. The detection relies on keyword matches within application logs from Spring-based applications that record these exception types.
references:
  - https://docs.spring.io/spring-security/site/docs/current/api/overview-tree.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/spring/spring_application_exceptions.yml
author: Thomas Patzke, Huntrule Team
date: 2017-08-06
modified: 2020-09-01
tags:
  - attack.initial-access
  - attack.t1190
logsource:
  category: application
  product: spring
detection:
  keywords:
    - AccessDeniedException
    - CsrfException
    - InvalidCsrfTokenException
    - MissingCsrfTokenException
    - CookieTheftException
    - InvalidCookieException
    - RequestRejectedException
  condition: keywords
falsepositives:
  - Application bugs
level: medium
license: DRL-1.1
related:
  - id: ae48ab93-45f7-4051-9dfe-5d30a3f78e33
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL